Basic Philosophy

To properly manage personal and confidential information, based on the Suzuki Basic Policy for Information Security, an information security officers’ committee was established under the Corporate Governance Committee to deal with information security in general including cybersecurity, and the Company is promoting the Suzuki Group’s information security measures.

Suzuki Basic Policy for Information Security

1. Legal Compliance

We shall comply with laws, regulations, national guidelines, contractual obligations, and other social norms related to information security.

2. Initiatives for information security and product security

To ensure that our customers can use our products and services with peace of mind, we shall address product security as part of our information security efforts.

3. Building of an information security management system

In addition to establishing an information security officers’ committee, we shall assign a person in charge of handling confidential information and an information security promoter to each internal department and organization, thereby establishing a structure to promote information security measures and management.

4. Establishment of internal regulations

We shall establish internal regulations concerning information security and make them known to all employees.

5. Establishment of an audit system

We shall conduct information security audits regularly and as needed to verify that information security-related laws and regulations are complied with and that regulations and rules are functioning effectively.

6. Implementation of information security measures

We shall implement organizational, technical, physical, and personnel security measures to prevent damage such as information leaks or alterations.

7. Implementation of education

We shall provide information security-related education and training for all employees in order to raise their awareness of and ability to deal with information security.

8. Management of outsourced contractors

We shall examine the security level of outsourced contractors. For important outsourced contractors, the security level shall be audited on a regular basis.

9. Implementation of continuous improvements

We shall continuously improve the overall system to ensure information security by regularly evaluating and reviewing the above efforts.

Management System

Under the information security officers’ committee, we have established countermeasure subcommittees such as those for management of confidential information and personal information, information security, product security, physical and personnel security, manufacturing division security, and AI risk management. We have established a system in which divisions relevant to the specific issue, including IT, Legal, Intellectual Property, and Public Relations, participate across divisions to discuss risk assessment and response measures. Additionally, we have set up a dedicated internal consultation desk where users can seek advice on AI utilization, thereby supporting its appropriate use.

Information security management system promotion organization（As of August 2026）

Measures Against Information Leakage and External Attacks

We obtained ISO 27001 (information security management system) certification in 2020, and we continue to maintain this certification by conducting Company-wide assessment activities and internal audits every year.

We have organized a dedicated Computer Security Incident Response Team (CSIRT) to prevent information security incidents, detect and resolve them at an early stage when they occur, and prevent recurrence after they occur. In preparation for the occurrence of such incidents, (1) the CSIRT collects and analyzes information on information security incidents and (2) conducts internal awareness-raising activities.

In addition, we conduct response training twice a year for CSIRT members on the assumption that an information security incident has occurred.

Implementation of Education

For information security, we provide the following training to all employees, including officers, as well as to all personnel in charge.

Implementation of information security education

We conduct the following education for all employees, including officers:

• E-learning training (once a year)
• Distribution of ISMS (information security) education cards (once a year)
• Education for new employees and for each level of training

Implementation of targeted attack e-mail response training

For all employees, including officers, we conduct targeted attack e-mail response training (once or twice a year) and distribute ISMS education cards to alert them to security issues and inform them of the contact information in case of a security incident.

Education for departmental information security officers

Twice a year, information security management education is conducted for personnel in charge of handling confidential information and information security promoters in each department.

Product Security

product security countermeasures committee

The information security officers’ committee has established a product security countermeasures committee, an organizational body that manages security operations from product development to disposal, and conducts regular management of product security. By continuing these activities, we ensure the daily safety and security of our customers.

PSIRT

The product security countermeasures committee has established a Product Security Incident Response Team (PSIRT) to collect industry information from organizations such as J-Auto-ISAC*, a Japanese automotive cybersecurity organization that collects and analyzes product-related security information, to prepare against product security attacks.

Product security audits and reporting

The product security countermeasures committee conducts annual audits to verify compliance with, and promote improvements to, organizational systems, regulations, and procedures related to product security, and regularly provides objective status reports to the information security officers’ committee. In addition, by regularly reporting on the status of PSIRT activities, the subcommittee responds rapidly to product security attacks.

Product Vulnerability Reporting Center

To improve quality of product security, we have established a vulnerability reporting center.
Please contact us at the email address below to report any vulnerabilities.

PSIRT@hhq.suzuki.co.jp

• When submitting a report, please include all information necessary for verification, such as the affected product, details of the issue, and steps to reproduce it.
• We do not accept reports regarding known vulnerabilities or information that has already been publicly disclosed.
• We ask that you provide information in good faith. We do not offer a bug bounty program.
• We will review the information you provide and take appropriate action as necessary.

Promoting AI and Risk Management

Basic approach to AI

Based on the Mission Statement and the Suzuki Group Code of Conduct, the Company views AI (artificial intelligence) as an important means of improving operational efficiency and creating value. Guided by Suzuki’s Philosophy of Conduct, we value the practice of using the time saved through utilizing AI to gain a deeper understanding of Genba, Genbutsu, and Genjitsu (Actual Place, Actual Thing, and Actual Situation), and of questioning AI’s responses by applying our own knowledge and experience. At the same time, recognizing that errors and hallucinations (presenting false information as if it were fact) can occur with AI, we are committed to both promoting its utilization and managing its risks.

AI Guidelines

We have formulated and implemented the “Guidelines for the Use of Generative AI” for all employees and have communicated internally the basic rules for safe and appropriate use of AI.
(Main contents)

• Confidential information must be handled only by AI tools authorized for such input.
• Do not take AI responses at face value. Make decisions only after personally verifying Genba, Genbutsu, and Genjitsu (Actual Place, Actual Thing, and Actual Situation).
• Do not use AI responses verbatim in materials for external distribution or in products. Appropriately indicate the source.
• Comply with the usage rules for each AI service.
  Furthermore, we are developing internal regulations that evaluate the reliability characteristics, such as fairness, transparency, accountability, and privacy, of AI intended for external release.

Initiatives

• Promoting AI utilization: We have developed in-house AI applications that can be safely used in business operations and deployed them company-wide through the internal portal.
• Establishing usage rules and providing training: We have established and communicated guidelines for the use of generative AI, and we provide opportunities to explain utilization methods and rules.
• Establishing a risk management system: For AI intended for external release, we are developing a system to assess risks and determine response policies under a deliberation system involving relevant divisions.
• Operation of a consultation desk: We operate a dedicated consultation desk for AI utilization, supporting employees in using AI appropriately.

Initiatives for Protecting Personal Information

All personal information handled by Suzuki (information on customers, business partners, shareholders, investors, employees, etc.) is important and valuable property entrusted to us by individuals, and we are deeply aware that handling this information carefully and appropriately is not only a legal obligation but also a social responsibility. Based on this awareness, we have established the "Suzuki Motor Corporation Basic Policy on Personal Information" and are working to protect personal information. Details of the handling of personal information are posted and published on Suzuki's official website.

Domestic site：
https://www.suzuki.co.jp/privacy_statement/index.html

Overseas site：
https://www.globalsuzuki.com/cookies/index.html

We have established internal rules for handling personal information appropriately and revise them as necessary in line with changes to laws, etc. We also make sure that all employees are aware of the importance of protecting personal information and that they handle it appropriately.

The following are specific initiatives taken by Suzuki with respect to managing personal information.